Domain Name Management in the Public Interest

Testimony Of Alan B. Davidson
Associate Director, Center for Democracy & Technology

before the

Senate Committee on Commerce, Science, and Transportation
Subcommittee on Communications

July 31, 2003

Chairman Burns, members of the Subcommittee, on behalf of the Center for Democracy and Technology I would like to thank you for this opportunity to testify on the important issues surrounding the management of the Internet's naming and numbering systems. We commend the Subcommittee for holding this hearing, because continuing Congressional oversight is necessary if we are to insure that the Internet's critical technical resources are managed in the public interest.

The Internet's great promise to promote economic opportunity, civic discourse, and the free flow of information relies largely on its open, decentralized nature. Yet even such a decentralized network of networks relies heavily on a small set of centralized mechanisms to coordinate the unique assignment of domain names and addresses online. These centralized naming and numbering systems are important because they way they are managed can affect Internet users around the world.

The Internet Corporation for Assigned Names and Numbers (ICANN) is an unprecedented experiment in open management of these important global resources. The idea behind it -- of global non-governmental bottom-up coordination -- is sound. The current alternatives to ICANN are not attractive. But serious questions persist about ICANN's public accountability and its ability to fulfill its role as a steward of an important global public trust. While CDT remains a believer in the ideal behind ICANN, close oversight by Congress and the Department of Commerce are essential to provide accountability for ICANN.

1. The vision underlying ICANN -- private-sector, bottom-up, technical coordination -- is still the right approach for administering key Internet functions.

The vision of a non-governmental body managing key coordination functions for the Internet -- a vision first spelled out by the Commerce Department six years ago -- remains the approach most likely to reflect the needs of the Internet community. Key features of this original vision included:

Non-governmental -- to benefit from more nimble private sector capabilities to handle fast-paced, complex Internet technical decisions, and more likely to reflect the diversity of user interests.
Bottom-up and consensus oriented -- making decisions in the best traditions of Internet bottom-up processes designed to account for broad interests
Narrowly focused -- to create trust that it would not exercise undue power and to increase comfort in its non-governmental character
Globally representative -- to ensure both public accountability and to include the interests of stakeholders affected by its decisions.

CDT continues to believe that an institution with these characteristics -- like the original conception of ICANN -- is the best approach to managing the narrow set of functions necessary to coordinate the domain name and numbering systems. If it can do a better job of realizing these objectives, ICANN has the potential to provide flexible, representative coordination that will support the Internet's continued growth.

Most of the alternatives to this vision of ICANN remain unattractive. The Commerce Department alone is likely to be an unacceptable global coordinator in the long run. Some envision a form of multi-lateral government administration of the Internet's critical functions. The private sector remains the most likely venue to provide the technical expertise and flexibility necessary for a rapidly evolving Internet. A bottom up and globally representative private body is more likely to provide opportunities for participation and accountability to the richly diverse Internet community than a government-only treaty organization.

Despite serious shortcomings, interest in this multilateral approach appears to be increasing in some circles. For example, as part of its World Summit on the Information Society (WSIS), the International Telecommunication Union (ITU) has hosted several discussions of Internet management. But the case has not been made that a government takeover of ICANN functions is likely to better reflect diverse community interests, and such a takeover should be resisted at his time.

2. ICANN will fail unless it makes significant progress in meeting its public interest obligations.

ICANN has had a number of significant accomplishments over the last few years. It has accredited nearly 200 domain name registrars, facilitating competition in the retail domain names market where none had previously existed. It has introduced seven new global Top-Level Domains (gTLDs), although many argue it should do more, and we understand there is no technical impediment to doing so. It has introduced a procedure for resolving disputes over name registration. And it has recently established the framework for agreements with country-code Top-Level Domains (ccTLDs). It has recently completed a reform process, though not without controversy, and has new leadership that has been welcomed broadly and that has set a new tone about ICANN�s work moving forward.

Most importantly from a user perspective, ICANN has facilitated the assignment of names and IP address blocks with high degree of stability, and has broadly enhanced competition.

At the same time, ICANN has a decidedly mixed record in meeting its public interest obligations, which stem from its delegated authority over globally critical Internet functions.[1]

ICANN has in many ways departed from the "bottom-up" and "consensus-based" policy processes that were so critical to giving stakeholders comfort that they would have a meaningful role in policy at ICANN. The great virtue of bottom-up consensus policy development is that it forces parties with differing views to engage , rather than simply trying to outvote each other. While there have been a few notable consensus policies, a frequent complaint is that decisions are made top-down by ICANN's Board, sometimes clearly against the stated views of much of the affected community.
There are insufficient limits on ICANN's regulatory authority, and no well-understood delineation of its powers. For example, ICANN's detailed and massive contracts with the gTLD registries lead many to be concerned about how far it can go in regulating the DNS. Much thinner contracts would adequately ensure stable coordination of the domain name system.
The user community and non-commercial interests are poorly represented at ICANN. Last year ICANN eliminated its nine "At-Large" board members, viewed as a central element to representing public interests. While the public election of At-Large directors was controversial, it is striking that ICANN has done so little to replace that representation. An at-large advisory council is still just forming, though welcome, and there are few chances for user influence at ICANN.
Accountability mechanisms are still lacking. For example, ICANN's ombudsman -- itself a pale shadow of the independent review process originally part of ICANN's bylaws -- has yet to be appointed.

ICANN's leadership has acknowledged many of these concerns, which is much appreciated, but it remains to be seen what concrete steps will be taken. Congress should not be left with the mistaken impression that ICANN's recent reform effort has taken care of these public accountability concerns. It has not.

Unless ICANN does more to address those shortcomings, it risks failure. Without progress on these accountability issues, ICANN risks becoming little more than a sophisticated trade association -- but one with substantial delegated powers. If ICANN continues to be viewed as unaccountable, non-representative, and without adequate limits on its powers, it will not be able to achieve the stability -- political, financial, and otherwise -- crucial to long-term success. If ICANN cannot earn the trust of the public, then users, companies, and organizations are more likely to undermine its activity than to embrace it.

Moreover, if ICANN is perceived as an unaccountable organization whose activities impinge on the rights of users worldwide, then powerful entities such as foreign governments, the ITU, or even the United Nations will accelerate their search for alternatives. Such approaches would likely include a vastly expanded role for governments, and could fuel efforts at multilateral regulation of the Internet -- a costly and user-unfriendly environment that could constrain innovation substantially.

If the goals of private, bottom-up coordination of key Internet functions are to be sustained, ICANN must do better at meeting its public interest obligations. Many at ICANN recognize this. We look forward to their efforts.

3. Benchmarks should be developed to assess ICANN's progress over time and to identify areas for improvement.

How do we assess whether ICANN is succeeding? This question is especially relevant as the Commerce Department prepares to renew its Memorandum of Understanding with ICANN this September -- and as people worldwide evaluate ICANN. Yet there is no widely agreed upon set of benchmarks for measuring how ICANN is doing -- and it is unclear how ICANN itself measures success.

Today CDT is releasing a new study, "Assessing ICANN: Towards Civil Society Metrics for Measuring ICANN," designed to assist in this process.[2] Our study is attached to this testimony and submitted for the record. In it, we review the literature and indicate key recurring themes or goals for ICANN. We then suggest ten "civil society metrics" for assessing ICANN from a public interest perspective:

Stable and secure coordination of key Internet functions.
Adherence to clearly defined scope of activities.
Accountability to affected stakeholders, including effective independent review procedures.
Transparency, including procedural and financial transparency.
Representation of key Interest groups, including the public's interests.
Acceptance by key stakeholders, ccTLDs, Regional Internet Registries, etc.
Minimized impact on user rights, such as privacy and free speech; consideration of impact on Less Developed Countries, etc.
Support for competition and, when possible, reliance on market mechanisms.
Increased security of the root server system.
Support for long-term evolution and innovation in information and computing technologies.

CDT believes that a set of commonly agreed metrics is critical to evaluating ICANN's strengths and shortcomings. Our hope is that other groups will use this list, or create their own, to develop a multi-sectoral approach to assessing ICANN. We look forward to the feedback of others interested in ICANN's evolution.

4. ICANN faces crucial tests over the next year on key issues of public interest, including Whois reform and the selection of new gTLDs.

In the next year, ICANN is expected to undertake several issues of broad interest to the Internet community -- including Whois database privacy, the selection of new top-level domains, root server security, and international domain names. The way it handles these issues will be a measure of its accountability and responsiveness after its reform process.

Privacy and the "Whois" database - The Whois database -- a public listing of contact information for millions of domain name registrants -- has long raised significant privacy concerns. Currently, the registrant of a domain name in the public gTLDs and many ccTLDs must make certain technical and administrative contact information available in the "Whois" database accessible to the public online. Originally designed to allow contact in the case of a technical problem, the database is now also used by law enforcement, consumer protection agencies, and private groups including intellectual property holders.

When individual Internet users register domain names, however, they can be forced to make their names, home addresses, home phone numbers, and home e-mail addresses publicly available to the world. Such potentially sensitive personal information, released publicly, can be used for unrelated purposes ranging from unwelcome marketing to identity theft, fraud, stalking, or other criminal activities. This exposure violates worldwide privacy norms and has put Whois on a collision course with national privacy laws, particularly in Europe, where is appears to violate the law of some countries.

A move is underway at ICANN to reform Whois in ways that will address individuals' privacy concerns while maintaining legitimate uses for the data. Proposals include the creation of a "tiered access" system for viewing Whois data, providing notice to users when their data is viewed, and creating "audit trails" that could expose abuse or misuse of the database. CDT believes a balance can be struck that protects privacy and allows reasonable access to data for important public purposes. ICANN's ability to incorporate the privacy interests of the global user community in this debate will be closely watched.

CDT strongly believes that recently proposed U.S. legislation criminalizing false Whois information is inappropriate.[3] It is simply unfair to make an Internet user a potential felon for putting incomplete or inaccurate personal information into a public database where there is no guarantee that their privacy or security will be protected. If better accuracy is desired in the Whois database, the best way to achieve it will be to protect the privacy of registrants.

Selection of new gTLDs -- Three years after selecting a first set of seven new global top level domains (such as .biz and .museum) ICANN is now launching a process for the selection of new gTLDs. Since gTLDs are a primary means of expression for millions of users, this process is of substantial public importance.

ICANN's process for selecting new gTLDs in 2000 raised procedural concerns that should be avoided in the future. Many observers questioned the "beauty contest" approach taken by ICANN, which relied heavily on relatively subjective and arbitrary criteria, and not enough on the technical merits of the applications. For many, this subjective approach was inappropriate, ripe for conflict and abuse, and corrosive to the technically-focused bottom-up vision of ICANN activity. ICANN is not a governmental body designed to make public choices about the allocation of property and wealth, nor should it want to become one.

Thoughtful proposals have been put forward for improving this process. They propose more objective criteria for new gTLDs -- including the selection of a fixed number annually by lottery or auction from among technically-competent bidders.[4]

ICANN has not yet announced what process it will use for the next major round of gTLD selections -- though for an immediate, smaller round it has declared its intention to use criteria similar to those used in 2000. CDT strongly believes that ICANN should avoid any appearance of arbitrariness in its next selections of gTLDs, and should pursue more objective systems consistent with its narrow technical coordination mission. ICANN should create minimum technical and financial requirements for new registries, and should announce a schedule by which these registries will be opened.

5. Congress and the Department of Commerce should continue their active oversight, and should renew ICANN's MoU only for a limited period.

The US Government explicitly -- and other nations implicitly -- has delegated administration of critical public interests to ICANN. Many outstanding questions remain about how that delegated responsibility is being met. There are few ways to hold ICANN accountable for its actions. Continued government oversight of ICANN is badly needed. We urge that:

ICANN's Memorandum of Understanding with the Department of Commerce should be renewed for no more than one year. The MoU is one of ICANN's few remaining tethers to traditional notions of public accountability. Today, ICANN has a new and untested leadership and is undergoing massive internal reorganization. Major checklist items from previous MoUs -- on topics from security to accountability to public representation -- are largely incomplete. The National Telecommunications and Information Administration (NTIA) itself is undergoing major changes. In such an uncertain environment, it would be inappropriate to renew ICANN's MoU for more than a year. The one year term adopted last year, with interim reports to DoC, has worked well and should be continued.
Congress should continue its active oversight of ICANN. While Congress should not be directing ICANN's activity -- no national government can if ICANN is to work -- the U.S. government had a special relationship with the root server system and ICANN. Congressional oversight has been an essential force for improving ICANN's transparency and raising public awareness about domain name policy issues. We hope that Congress will continue to monitor ICANN's work closely.
NTIA should publicly report on ICANN, and should consider appointing a commission to report on ICANN's progress and public accountability. By promoting better discussion of ICANN, either on its own or in cooperation with a commission of stakeholders, NTIA could facilitate and focus ICANN's own progress toward these goals. An NTIA commission could also give voice to the perspectives of interests who find it difficult to be heard in the ICANN process.

If ICANN is able to show progress in its commitment to a limited mission, public accountability, and other goals, it will greatly strengthen its position among Internet users worldwide. If it is not, it risks rejection by the Internet community and the community of nations. We look forward to working with ICANN, the Commerce Department, and the broader Internet community to help make community-based Internet coordination a success.

The Center for Democracy and Technology is a 501(c)(3) non-profit organization working to promote democratic values and constitutional liberties in the digital age. With expertise in law, technology, and policy, CDT seeks practical solutions to enhance free expression and privacy in global communications technologies. CDT is dedicated to building consensus among all parties interested in the future of the Internet and other new communications media.

Notes

Links accurate as of July 31, 2003. Links will open in a new browser window.

1. These obligations, and ICANN's record in meeting them, are discussed more fully in ICANN, Legitimacy, and the Public Voice: Making Global Participation and Representation Work, NGO and Academic ICANN Study, August 2001, Available at http://www.naisproject.org/report/final/. CDT was a partner in the NAIS effort.

2. This report was produced with the support of the Markle Foundation.

3. H.R. 2572, introduced in July 2003, would make it a federal felony to submit false Whois information "with an intent to defraud" � a vague standard that could sweep in a great deal of relatively innocent behavior.

4. See, e.g., Mueller, Milton, and Lee McKnight, "The Post-.COM Internet: A Five-Step Process for Top Level Domain Additions," March 2003. Available at http://dcc.syr.edu/miscarticles/NewTLDs-MM-LM.pdf. Another excellent resource is Crawford, Susan, and David Johnson. "Old Delusions and New TLDs." November 13, 2002. Available at http://forum.icann.org/gtld-plan-comments/general/msg00003.html.