Text File

precedence: bulk Subject: Risks Digest 20.96

RISKS-LIST: Risks-Forum Digest Sunday 23 July 2000 Volume 20 : Issue 96

FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <URL:http://catless.ncl.ac.uk/Risks/20.96.html> and by anonymous ftp at ftp.sri.com, cd risks .

Contents: PFIR Statement on Internet Policies, Regulations, and Control (Lauren Weinstein and Peter G. Neumann) Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Sun, 23 Jul 2000 22:24 PDT From: lauren@vortex.com (Lauren Weinstein) Subject: PFIR Statement on Internet Policies, Regulations, and Control

PFIR Statement on Internet Policies, Regulations, and Control July 23, 2000 http://www.pfir.org/statements/policies

Executive Summary -----------------

It is increasingly clear that the Internet, as embodied by the World Wide Web and a wide variety of other Net-based services and technologies is rapidly becoming a critical underpinning and foundation to virtually every aspect of our lives, from the very fundamental to the exceedingly mundane. It is likely that few aspects of commerce, education, communications, government, entertainment, or any other facets of our daily existence will be unaffected by this exceedingly rapid change that is sweeping the globe far more rapidly than would have been anticipated only a few years ago.

These global and interconnected developments, unprecedented in human history, suggest that decisions regarding policies, regulation, control, and related Internet activities will be of crucial concern to the *entire* world's population. Consequently, the proper representation of many varied interests regarding such activities must be respected.

It is our belief that the current mechanism for making many key decisions in this regard, as embodied in The Internet Corporation for Assigned Names and Numbers, "ICANN" (http://www.icann.org), is proving to be inadequate to the task at hand. We believe that this is the result primarily of structural and historical factors, not the fault of the individuals directing ICANN's activities, whom we feel have been genuinely attempting to do the best possible job that they could with highly complex, contentious, and thankless tasks.

We are convinced that the Internet's future, and the future of humanity that will be depending upon it to ever increasing degrees, would be best served by consideration being given to the establishment of a new, not-for-profit, voluntary, international organization to coordinate issues of Internet policies and related matters. This organization would be based on a balanced representation of private-sector commercial and non-commercial interests, and public-sector interests including governmental bodies and organizations, educational institutions, and other enterprises.

Although the proposed course of action is expected to be difficult, the risks of inaction are enormous and likely to increase dramatically in the coming years.

The Historical Basis --------------------

The historical path that has led us to the current juncture is well summarized in a recent U.S. General Accounting Office (GAO) Report (http://www.pfir.org/gao-icann.pdf). It details how the late Dr. Jon Postel, Director of the Computer Networks Division of the USC Information Sciences Institute (USC-ISI), nearly singlehandedly managed many of the core aspects of Internet number assignments, hostname and domain management, and related tasks reaching back decades to the early days of the Internet's ancestor the U.S. Department of Defense ARPANET.

As one of the Net's earliest pioneers, he conducted this work under Department of Defense contracts related to the Net's ongoing development and support, and given that there were few (if any) commercial pressures related to the Net over most of those years, he was pretty much left alone to handle matters as he saw fit, ultimately as the IANA -- the Internet Assigned Numbers Authority. He did a remarkable job without which the development of the ARPANET and Internet would have been far less successful than they were as a result of his efforts.

Dr. Postel's untimely and unexpected death in 1998, less than two years ago, left both a professional and personal gap for many of us. It also raised the specter of many potential problems, given the rapidly changing nature of the Internet. We now see that many of these concerns were indeed well-founded. Before his death, Dr. Postel had been instrumental in the creation of ICANN, as an entity to fulfill the U.S. Federal Government mandate that Internet operational policy and control matters be fully privatized. The interim ICANN board of directors which he selected constituted itself as the formal board of the corporation after his death.

The GAO report discusses in detail the sequence of events through which various authority has been invested in the resulting ICANN non-profit corporation. While as recently as 1996 the IANA and other groups were proposing an international consortium to be based in Switzerland to deal with these issues, the existing incarnation of ICANN is headquartered in Marina Del Rey, California, in the same office building tower that has long housed the USC-ISI facilities where Dr. Postel labored throughout the years.

The Current Situation and Problems ----------------------------------

ICANN takes pains to describe itself as not "controlling" the Internet, but in practice the decisions and functions that it performs exert a degree of influence over existing Internet operations that may be difficult to differentiate from "control" except in a linguistic sense. However, it is certainly the case that by and large, there is no general rule of law *requiring* Internet-connected entities, from businesses to educational institutions, and from Internet Service Providers (ISPs) to individual Internet users, to conform to the structure of the existing network and the currently defined policies.

While there are technical considerations making it impractical for large portions of the network to migrate quickly to different domain naming servers and other related mechanisms, it would at least be theoretically possible, essentially by system administrators and users editing a few files on their systems. This underscores the remarkable fact that ICANN's role (as documented in the GAO report) is derived from only broad statutory authorities of various U.S. Government Agencies, since the U.S. Congress has not enacted legislation addressing these specific matters.

Unfortunately, even a few years ago it was not possible to accurately foresee the degree to which the Internet would very quickly permeate so many aspects of domestic and international commerce, education, privacy, security, law enforcement, and so many other facets of our societies. Nor was it clear how rapidly large commercial interests and incredibly vast sums of money would move into the Internet, in many cases resulting in attempts to redefine the network in a purely commercial context.

The resolving of the resulting tensions, problems, and disputes present an immense challenge that the fundamentally informal and ad hoc nature of ICANN does not appear well-suited to undertake. ICANN's style of decision-making and "making up the rules as we go" that worked so admirably as the ARPANET and Internet were in their relatively slow, gradual stages of non-commercial development now seem to be contributing to the strains of Internet policy, rather than alleviating them.

Some examples of these continuing problems and the resulting troubling changes are obvious even from the most recent ICANN meeting, held in Yokohama, Japan in mid-July, 2000. Even though many observers had felt that the registration and voting plan chosen by ICANN to facilitate the election of "At Large" directors was inherently flawed, it was still alarming at this late stage to see the ICANN board backpedaling on the election schedule for some of the At Large directors.

Also troubling is the manner in which the board plans to start a new study concerning the entire concept of At Large directors and how they would be handled in the future. While it is worthwhile that ICANN has apparently recognized that some of their previous decisions in this regard may be flawed, it is of concern to see such important decisions made, altered, and subjected to major reevaluations in such short order. Such rapid changes in direction are not conducive either to the confidence or the understanding of those persons in either the public or private sectors who necessarily view this process from afar.

Similarly, the contentious issue of domain names (which seems to attract much of the attention and time, but ultimately is likely to be one of the least important issues relating to the future of the Internet) still seems to be spinning like a top. While ICANN announced that new Top Level Domain Names (TLDs) would be assigned, they left the world pretty much hanging in the wind concerning most details, which were put off until later in the year.

One detail that they did establish is among the most questionable -- the assignment of a USD $50,000 *non-refundable* "application fee" payable by any entity that wishes to be the registrar for a new TLD. While ICANN's desire to deal with organizations that would be able to provide stability to domain name handling is laudable, an essentially arbitrary fee of this nature has the effect of "locking out" organizations (especially of a non-commercial nature) who might very well be ideally suited to handling a TLD, but who don't have a spare $50K laying around to irretrievably devote to an application fee that might well lead nowhere. Meanwhile, concerns over the fairness of the existing domain-name resolution dispute policies continue to bubble up on a seemingly daily basis.

Again, we wish to emphasize that we consider these and similar problems to relate to the fundamental history and structure of ICANN, not to a lack of concern or positive intentions on the part of its directors. However, we feel that it has become clear that the foundation of ICANN is inappropriate for the sort of entity that is needed to appropriately lead the Internet in a direction to benefit the totality of the world's populations into the future.

A Proposal for a Different Approach -----------------------------------

We suggest that only a *completely new*, more formally structured, not-for-profit, internationally-based organization is suited to this task, with clearly and precisely-defined delegations to represent a broad range of concerns and interests. We explicitly feel that existing domestic and international organizations, such as the Internet Engineering Task Force (IETF) or the United Nations, are unsuited to this purpose -- because they would inevitably bring too much historical "baggage" and existing conflicts to the table. An effective framework for dealing with these issues needs to start from first principles.

This new organization would exist solely for the purposes of helping to resolve and manage the range of complex issues relating to the global Internet, many of which are impossible to even begin to effectively approach without international cooperation and broad agreements. We believe that this organization could thus play a major role towards helping to ensure that the Internet evolves in a manner to best benefit people around the world. Freedom of choice and the encouragement of diversity are extremely important factors when dealing with these issues. The organization would neither desire nor seek the power to impose outside decisions upon any national government or other governmental bodies, whose participation would be completely voluntary and who would always maintain sovereignty over their own decisions regarding the manner in which they and their citizens would access or otherwise use the Internet.

We do not intend this document as a blueprint for the detailed structure or operations of such a newly constituted organization, but rather as a starting point for further discussions and consideration of this concept -- as a first step. With that in mind, we proceed to offer some foundational assumptions regarding such an organization.

A primary tenet would be that this proposed organization be truly and *formally* international in nature. This means that the delegations, with decision-making powers, would be chosen in a formal manner from "day one" to provide balance to the deliberations amongst the many varied domestic and international entities and interest groups around the world. A defined procedure would also exist for the bringing of new groups and interests into the formal process in an appropriate manner.

The organization should be constituted in such a way as to not only represent the needs and desires of the existing developed countries where most Internet activity is currently taking place, but also the needs of the underdeveloped and developing worlds, who are in some cases already being thrust onto the Internet, but find themselves with few if any avenues to impact its directions or orientations. Similarly, the needs of economically-disadvantaged persons and groups in any countries must have consideration and weight in the process (relating to the aptly-named "digital divide"), not just the economically-advantaged to whom the bulk of the existing attention regarding Internet policies and development have been skewed.

The desires of the commercial arena are of course of great importance to the growth, development, and use of the Internet, but they cannot continue to be of *overriding* precedence as increasingly now appears to be the case. To that end, the organization would include delegations to balance the interests of for-profit and non-profit, commercial and non-commercial groups and persons, with all facets having a relatively equal voting share towards the outcome of deliberations. Should educational and non-profit research institutions and focused public service groups have a formal say towards the Internet's future as well as billion-dollar for-profit corporations? We say yes.

A third balancing but *not* dictatorial element of the proposed organization would be public sector participation by domestic governments and their various institutions. While we realize that this is a controversial element, we feel that it is absolutely crucial. Privatization may be all the rage, but it is unrealistic in the extreme to expect successful management of the Internet, its resources, and the many competing concerns of the world's citizenries without at least some government involvement in the process. Neither the for-profit nor non-profit worlds can be expected to adequately fulfill this role on their own.

The lack of a formal role for governments and the interests of government agencies in the *global* process of Internet policymaking is already resulting in all manner of unfortunate and even dangerous abberations. The national governments of many countries are already implementing unilateral rules, restrictions, and sometimes bizarre policies, many of which are nonsensical when taken in the international borderless context of the Internet. The result is confusion all around, for individual users, businesses, non-profit organizations, and everyone else. International disputes, such as the continuing disagreements between the European Union and the United States over consumer and Internet privacy policies, are another example of the problems that result when these issues are not dealt with adequately on a continuing, developmental basis, with input from national governments *and* the other groups we've defined above, on a *cooperative* basis all throughout the process.

Attempts to keep the Internet policymaking process free of government input have often resulted in governments swooping in later, frequently with what might be characterized as "knee-jerk" reactions, often to the detriment of the Internet and its global community. It would be far better to define the participatory role of governments in the first place, and have them as part of the team, rather than as an after-the-fact "spoiler" kept on the sidelines for most of the deliberations process. They deserve to be involved, and they should be involved.

Of course, the various participatory categories as defined above are not the only manner in which the range of involved interests could be organized. Educational institutions, for example, can fall into for-profit, non-profit, public, and private classifications, suggesting other possible ways to structure or define these categories. The important point is that whatever detailed organization is chosen, it be formally structured in a manner that guarantees balanced and appropriate participation by all involved parties.

Will the creation and operation of this proposed organization be simple or without any conflict? No and no -- without doubt, it will be an extremely difficult undertaking, without any guarantee of success. Determining the details of a fair system for representation and voting by the many diverse persons, interests, groups, and institutions who would be involved will be challenging to say the very least, and there will be many other difficult issues to resolve.

On the other hand, it is obvious that the existing process is not working, and appears to be leading us ever farther down a path of increasing conflicts, rising confusion, growing concerns, and simmering anger on the part of users and organizations -- plus ever more radical reactions. The internationally-focused, formally-balanced approach proposed herein may have a chance of helping to steer the incredible hybrid of people and machines -- the Internet -- onto a course that will benefit *all* of humanity.

The Internet is undoubtedly one of the most powerful tools that has come to pass in human history -- for good or ill. To squander it, to allow short-sighted attitudes or the self-interests of any particular groups or individuals to divert its course to the detriment of society, would earn us the condemnation of the future. How much better it would be to instead earn the future's thanks, for doing what we knew was right, when we had the opportunity to do so.

- - - - -

Lauren Weinstein lauren@pfir.org or lauren@vortex.com or lauren@privacyforum.org Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Moderator, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy

Peter G. Neumann neumann@pfir.org or neumann@csl.sri.com or neumann@risks.org Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Moderator, RISKS Forum - http://catless.ncl.ac.uk/Risks Chairman, ACM Committee on Computers and Public Policy http://www.csl.sri.com/neumann

------------------------------

Date: 13 Dec 1999 (LAST-MODIFIED) From: RISKS-request@csl.sri.com Subject: Abridged info on RISKS (comp.risks)

The RISKS Forum is a MODERATED digest. Its Usenet equivalent is comp.risks. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. Alternatively, via majordomo, SEND DIRECT E-MAIL REQUESTS to <risks-request@csl.sri.com> with one-line, SUBSCRIBE (or UNSUBSCRIBE) [with net address if different from FROM:] or INFO [for unabridged version of RISKS information] .MIL users should contact <risks-request@pica.army.mil> (Dennis Rears). .UK users should contact <Lindsay.Marshall@newcastle.ac.uk>. => The INFO file (submissions, default disclaimers, archive sites, copyright policy, PRIVACY digests, etc.) is also obtainable from http://www.CSL.sri.com/risksinfo.html ftp://www.CSL.sri.com/pub/risks.info The full info file will appear now and then in future issues. *** All contributors are assumed to have read the full info file for guidelines. *** => SUBMISSIONS: to risks@CSL.sri.com with meaningful SUBJECT: line. => ARCHIVES are available: ftp://ftp.sri.com/risks or ftp ftp.sri.com<CR>login anonymous<CR>[YourNetAddress]<CR>cd risks [volume-summary issues are in risks-*.00] [back volumes have their own subdirectories, e.g., "cd 19" for volume 19] http://catless.ncl.ac.uk/Risks/VL.IS.html [i.e., VoLume, ISsue]. http://the.wiretapped.net/security/textfiles/risks-digest/ . ==> PostScript copy of PGN's comprehensive historical summary of one liners: illustrative.PS at ftp.sri.com/risks .

------------------------------

End of RISKS-FORUM Digest 20.96 ************************