Network Solutions Inc, one of the largest domain name registrars, has published a report it said showed that ICANN should more heavily regulate VeriSign Inc, Neustar Inc and Afilias Ltd, the top three domain registries that ICANN oversees.
The move comes as registrars including NSI lobby the US Department of Commerce and Congress to block the proposed ICANN contracts under which the three registries would continue to run .com, .org, .info and .biz.
The contracts would remove or relax pricing controls, potentially slimming down registrars’ margins. Presumptive renewal clauses would also essentially remove the possibility of the registry contracts coming up for competitive bidding in future.
NSI published a report, DNS – A System In Crisis, that it commissioned from security consultant Jerry Archer, a 30-year technology veteran, most recently a senior vice president at Visa International.
The report is another tool NSI can try to use to help get the proposed contracts killed and sent back to ICANN for changes or renegotiation.
Archer and NSI do not say that the contracts themselves will directly make the DNS less secure, rather that they do not create enough security obligations. The report makes 10 recommendations for provisions that should be included in the contracts.
If the contracts are issued as they stand now, they essentially create monopolies for all registries, not just VeriSign, Archer told us. If you do that then what ICANN needs to do is insert adequate security provisions, otherwise registry operators have no compelling reason to implement these security measures.
The registries have argued that presumptive renewal gives them the incentive to invest in their infrastructure. NSI and Archer appear to argue the opposite, that presumptive renewal allows them to sit back, enjoy their profits, and not spend adequately on security.
ICANN is relying on the goodwill of registries to perform these security measures, NSI vice president Jonathon Nevett said. Certainly, if you’re talking about the monopoly perspective there is no competition or market-based pressure to do it.
While the Archer report talks about more domains than just .com, it’s pretty clear that NSI’s main concern is preventing VeriSign getting the price-raising powers it wants, which would allow it to raise prices 7% in four of the next six years.
Such price increases would mean NSI would have to raise its prices too, or suffer lower profit margins. NSI and others, such as Go Daddy Inc, have been spending lots of money lobbying Congress to have the deals investigated.
The related notions of security and stability are VeriSign’s traditional sales pitches when it comes to negotiating with ICANN or the powers that be in Washington DC.
The .com namespace has billions of dollars of revenue relying upon it, so its stability is very important, and VeriSign has made much of the claim that it currently has a 100% uptime record.
But NSI and Archer’s report are more concerned in talking up the security and stability problems that could arise in future, if VeriSign and the other registries are not regulated heavily enough.
The Archer report says that registries should be contractually obliged to, among other things, test their systems’ security, make frequent reports to ICANN, to supply ICANN with a security plan, and to conduct risk assessments.
NSI, having previously played up the antitrust card, is now essentially trying to use VeriSign’s own security and stability arguments against it. VeriSign’s did not disagree with Archer’s recommendations.
The recommendations proposed in the report are already either being done by VeriSign, are things we have recommended or are things we would welcome, VeriSign spokesperson Tom Galvin said in an emailed statement.
VeriSign already briefs ICANN on security issues, already has a security plan, and already regularly tests its defenses, he said. He noted that ICANN’s Security and Stability Advisory Committee already looks at such matters.
The proposed .biz, .info, and .org contracts have yet to be approved by ICANN’s board of directors, but the .com contract was approved almost six months ago, and submitted to the National Telecommunications and Information Administration, part of the Department of Commerce, for the final OK.
There, it has been held in political limbo for an unusually long time, apparently awaiting Congressional scrutiny and a Department of Justice review of its competitive impact. It also seems unlikely that it will be approved before NTIA acting assistant secretary John Kneuer receives his confirmation from the Senate.
